@caeliq/llms@1.0.74
A universal LLM API transformation server
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe flagged metadata and credential patterns are consistent with bundled cloud-auth libraries, but the server also automatically adds local path and platform details to prompts sent to OpenCode. This is a runtime privacy risk, so the package should receive a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A request uses the OpenCode free-tier endpoint.
Impact
The OpenCode service receives local path and platform details that the caller did not explicitly include.
Mechanism
The server adds the working directory, platform, and temporary-directory guidance to the request's system text.
AI rationale
The flagged metadata and credential patterns are consistent with bundled cloud-auth libraries, but the server also automatically adds local path and platform details to prompts sent to OpenCode. This is a runtime privacy risk, so the package should receive a warning.
Evidence
dist/esm/server.mjs
Network endpoints1
opencode.ai
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The environment fingerprint is added only when a request matches the OpenCode free-tier endpoint condition.
- The fingerprint reads the working directory, temporary-directory setting, and platform.
- The generated system text includes the working directory, workspace root, platform, and temporary-directory guidance.
Evidence against
- The manifest describes the package as an LLM API transformation server.
- No lifecycle scripts are declared in the manifest.
- The environment disclosure is conditional on a request to OpenCode's free-tier endpoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
12 flaggeddist/esm/server.mjsView file
1var EF=Object.create;var Om=Object.defineProperty;var vF=Object.getOwnPropertyDescriptor;var xF=Object.getOwnPropertyNames;var RF=Object.getPrototypeOf,DF=Object.prototype.hasOwnPr...
L2: -- Key to operate on
...
L58: `:case"\u2028":case"\u2029":return Y(),"";case"\r":return Y(),Sr()===`
L59: `&&Y(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw Ge(Y());case void 0:throw Ge(Y())}return Y()}function aM(){let t="",e=Sr();if(!at.isHexDigit...
L60: `+s;T=w.join(E),k=`{
...
L64: `+s+T+`,
L65: `+b+"]"}return o.pop(),s=b,w}}});var sg=K((ZJ,Gk)=>{var lM=Hk(),dM=Wk(),fM={parse:lM,stringify:dM};Gk.exports=fM});var UE=K((TX,XL)=>{XL.exports={"0":"\u2080","1":"\u2081","2":"\u2...
L66: `)||r,code:s,status:o},e.data.error)}return Object.assign({message:r,code:s,stat
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/esm/server.mjsView on unpkg · L1111${y}
L112: `+await t.crypto.sha256DigestHex(g),m=await n6(t.crypto,t.securityCredentials.secretAccessKey,i,t.region,r),b=await wc(t.crypto,m,_),h=`${EO} Credential=${t.securityCredentials.acc...
L113: To learn more about authentication and Google APIs, visit:
High
Child Process
Package source references child process execution.
dist/esm/server.mjsView on unpkg · L111Findings
2 Critical9 High4 Medium3 Low
CriticalCredential Exfiltrationdist/esm/server.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/server.cjs
HighChild Processdist/esm/server.mjs
HighShelldist/cjs/server.cjs
HighSame File Env Network Executiondist/esm/server.mjs
HighCommand Output Exfiltrationdist/esm/server.mjs
HighCloud Metadata Accessdist/esm/server.mjs
HighRemote Agent Bridgedist/esm/server.mjs
HighCopied Package Dependency Bridgedist/esm/server.mjs
HighTrigger Reachable Credential Exfiltrationdist/cjs/server.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cjs/server.cjs
Affected versions and remediation
This report applies to @caeliq/llms@1.0.74.
See all versions of @caeliq/llms for other recorded verdicts.
- Review the evidence and your use of @caeliq/llms@1.0.74 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.